From: Lee Jones <lee@kernel.org>
To: lee@kernel.org, Jiri Kosina <jikos@kernel.org>,
Benjamin Tissoires <benjamin.tissoires@redhat.com>,
Aaron Skomra <aaron.skomra@wacom.com>,
Ping Cheng <ping.cheng@wacom.com>,
linux-input@vger.kernel.org, linux-kernel@vger.kernel.org
Cc: stable@vger.kernel.org, Jiri Kosina <jkosina@suse.com>
Subject: [STABLE v5.10 1/5] HID: wacom: Advertise SW_MUTE_DEVICE capability prior to registration
Date: Mon, 9 Nov 2026 13:39:02 +0000 [thread overview]
Message-ID: <20261109133911.3026622-2-lee@kernel.org> (raw)
In-Reply-To: <20261109133911.3026622-1-lee@kernel.org>
[ Upstream commit ba16e5ffbaa10fde960918d69af5e49f2b3fdd5e ]
Input subsystem guidelines require that device capabilities are advertised
before the input device is registered. The Wacom driver was violating
this by advertising the SW_MUTE_DEVICE capability post-registration in
wacom_set_shared_values() (and duplicating it in device-specific setup
cases).
Resolve this by moving the SW_MUTE_DEVICE capability setup to
wacom_setup_touch_input_capabilities() for all touch devices that support
it.
For generic touch devices whose capabilities depend on mute switch
usages parsed from a sibling Pen/Pad interface, defer registration
with -EPROBE_DEFER until the sibling has parsed its descriptors and
initialized shared capabilities.
Cc: stable@vger.kernel.org
Fixes: d2ec58aee8b1 ("HID: wacom: generic: support generic touch switch")
Signed-off-by: Lee Jones <lee@kernel.org>
Acked-by: Ping Cheng <ping.cheng@wacom.com>
Tested-by: Ping Cheng <ping.cheng@wacom.com>
Signed-off-by: Jiri Kosina <jkosina@suse.com>
[Lee: Retain devm_add_action() error handling and adapt context around
is_soft_touch_switch and wacom_initialize_battery()]
Signed-off-by: Lee Jones <lee@kernel.org>
---
drivers/hid/wacom_sys.c | 86 ++++++++++++++++++++++++++++++++++-------
drivers/hid/wacom_wac.c | 5 +++
2 files changed, 77 insertions(+), 14 deletions(-)
diff --git a/drivers/hid/wacom_sys.c b/drivers/hid/wacom_sys.c
index f418efa868ee..e5d12683f578 100644
--- a/drivers/hid/wacom_sys.c
+++ b/drivers/hid/wacom_sys.c
@@ -924,6 +924,9 @@ static int wacom_add_shared_data(struct hid_device *hdev)
wacom_wac->shared = &data->shared;
+ if (wacom_wac->has_mute_touch_switch)
+ WRITE_ONCE(wacom_wac->shared->has_mute_touch_switch, true);
+
retval = devm_add_action(&hdev->dev, wacom_remove_shared_data, wacom);
if (retval) {
mutex_unlock(&wacom_udev_list_lock);
@@ -931,11 +934,6 @@ static int wacom_add_shared_data(struct hid_device *hdev)
return retval;
}
- if (wacom_wac->features.device_type & WACOM_DEVICETYPE_TOUCH)
- wacom_wac->shared->touch = hdev;
- else if (wacom_wac->features.device_type & WACOM_DEVICETYPE_PEN)
- wacom_wac->shared->pen = hdev;
-
out:
mutex_unlock(&wacom_udev_list_lock);
return retval;
@@ -2336,22 +2334,76 @@ static void wacom_release_resources(struct wacom *wacom)
static void wacom_set_shared_values(struct wacom_wac *wacom_wac)
{
+ struct wacom *wacom = container_of(wacom_wac, struct wacom, wacom_wac);
+
+ guard(mutex)(&wacom_udev_list_lock);
+
+ if (wacom_wac->has_mute_touch_switch) {
+ WRITE_ONCE(wacom_wac->shared->has_mute_touch_switch, true);
+ wacom_wac->shared->is_touch_on = true;
+ }
+
if (wacom_wac->features.device_type & WACOM_DEVICETYPE_TOUCH) {
wacom_wac->shared->type = wacom_wac->features.type;
wacom_wac->shared->touch_input = wacom_wac->touch_input;
+ wacom_wac->shared->touch = wacom->hdev;
+ } else if (wacom_wac->features.device_type & WACOM_DEVICETYPE_PEN) {
+ /* Pairs with smp_load_acquire() in wacom_sibling_pending() */
+ smp_store_release(&wacom_wac->shared->pen, wacom->hdev);
}
+}
- if (wacom_wac->has_mute_touch_switch) {
- wacom_wac->shared->has_mute_touch_switch = true;
- wacom_wac->shared->is_touch_on = true;
- }
+static bool wacom_sibling_pending(struct wacom *wacom)
+{
+ const struct wacom_features *features = &wacom->wacom_wac.features;
+ struct hid_device *hdev = wacom->hdev;
+ struct usb_interface *sibling_intf;
+ int ifnum;
+
+ if (features->type != HID_GENERIC ||
+ !(features->device_type & WACOM_DEVICETYPE_TOUCH))
+ return false;
- if (wacom_wac->shared->has_mute_touch_switch &&
- wacom_wac->shared->touch_input) {
- set_bit(EV_SW, wacom_wac->shared->touch_input->evbit);
- input_set_capability(wacom_wac->shared->touch_input, EV_SW,
- SW_MUTE_DEVICE);
+ if (wacom->wacom_wac.shared) {
+ /* Pairs with smp_store_release() in wacom_set_shared_values() */
+ if (smp_load_acquire(&wacom->wacom_wac.shared->pen))
+ return false;
}
+
+ if (!hid_is_usb(hdev) || !wacom->usbdev || !wacom->intf ||
+ !wacom->intf->cur_altsetting)
+ return false;
+
+ ifnum = wacom->intf->cur_altsetting->desc.bInterfaceNumber;
+
+ /*
+ * On composite Wacom devices, the Pen interface is always interface 0.
+ * If the Touch interface is interface 0, there is no sibling Pen
+ * interface on this device (standalone touch device).
+ */
+ if (ifnum == 0)
+ return false;
+
+ /* Look for the sibling Pen interface at interface 0 */
+ sibling_intf = usb_ifnum_to_if(wacom->usbdev, 0);
+ if (!sibling_intf || !sibling_intf->cur_altsetting)
+ return false;
+
+ if (sibling_intf->cur_altsetting->desc.bInterfaceClass !=
+ USB_INTERFACE_CLASS_HID)
+ return false;
+
+ if (sibling_intf->cur_altsetting->desc.bInterfaceSubClass == 1 &&
+ (sibling_intf->cur_altsetting->desc.bInterfaceProtocol == 1 ||
+ sibling_intf->cur_altsetting->desc.bInterfaceProtocol == 2))
+ return false;
+
+ /*
+ * Interface 0 is a candidate HID interface on this composite device
+ * whose probe has not completed yet (shared->pen is NULL). Defer until
+ * interface 0 finishes probing and registers shared values.
+ */
+ return true;
}
static int wacom_parse_and_register(struct wacom *wacom, bool wireless)
@@ -2427,6 +2479,11 @@ static int wacom_parse_and_register(struct wacom *wacom, bool wireless)
if (error)
goto fail;
+ if (wacom_sibling_pending(wacom)) {
+ error = -EPROBE_DEFER;
+ goto fail;
+ }
+
if (!(features->device_type & WACOM_DEVICETYPE_WL_MONITOR) &&
(features->quirks & WACOM_QUIRK_BATTERY)) {
error = wacom_initialize_battery(wacom);
@@ -2491,6 +2548,7 @@ static int wacom_parse_and_register(struct wacom *wacom, bool wireless)
fail_hw_stop:
hid_hw_stop(hdev);
+ cancel_delayed_work_sync(&wacom->init_work);
fail:
wacom_release_resources(wacom);
return error;
diff --git a/drivers/hid/wacom_wac.c b/drivers/hid/wacom_wac.c
index f74da953d78f..8804bc2cba32 100644
--- a/drivers/hid/wacom_wac.c
+++ b/drivers/hid/wacom_wac.c
@@ -3882,6 +3882,11 @@ int wacom_setup_touch_input_capabilities(struct input_dev *input_dev,
if (features->type == HID_GENERIC) {
hid_dbg(hdev, "generic touch setup\n");
+ if (wacom_wac->has_mute_touch_switch ||
+ (wacom_wac->shared && READ_ONCE(wacom_wac->shared->has_mute_touch_switch))) {
+ input_set_capability(input_dev, EV_SW, SW_MUTE_DEVICE);
+ wacom_wac->has_mute_touch_switch = true;
+ }
/* setup has already been done */
return 0;
}
--
2.56.0.506.g506a7eabc5-goog
next prev parent reply other threads:[~2026-11-09 13:39 UTC|newest]
Thread overview: 7+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-11-09 13:39 [STABLE v5.10 0/5] HID: wacom: Fix Use-After-Free vulnerabilities and SW_MUTE_DEVICE registration Lee Jones
2026-11-09 13:39 ` Lee Jones [this message]
2026-11-09 13:39 ` [STABLE v5.10 2/5] HID: wacom: Fix Use-After-Free in wacom_intuos_pad Lee Jones
2026-11-09 13:39 ` [STABLE v5.10 3/5] HID: wacom: Fix Use-After-Free in wacom_bamboo_pad Lee Jones
2026-11-09 13:39 ` [STABLE v5.10 4/5] HID: wacom: Write shared touch initial status only once Lee Jones
2026-11-09 13:39 ` [STABLE v5.10 5/5] HID: wacom: Setup SW_MUTE_DEVICE according to the order of input registration Lee Jones
2026-11-10 20:59 ` [STABLE v5.10 0/5] HID: wacom: Fix Use-After-Free vulnerabilities and SW_MUTE_DEVICE registration Sasha Levin
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20261109133911.3026622-2-lee@kernel.org \
--to=lee@kernel.org \
--cc=aaron.skomra@wacom.com \
--cc=benjamin.tissoires@redhat.com \
--cc=jikos@kernel.org \
--cc=jkosina@suse.com \
--cc=linux-input@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=ping.cheng@wacom.com \
--cc=stable@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.